I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1000-2000 and 3000-4000 and so on. It appears perfectly, but I never have 2000-3000 appear any help?
index=gasf host="*hub-vpn*" uri_path="*default.aspx" referer!="*SSOLogon*" | rex "(?<response_time>\d+)\s[\-\+]$" | eval resTimeInMS=round((response_time/1000),2) | bucket resTimeInMS span=1000 | timechart span=15m c by resTimeInMS usenull=f
It does not appear because you have no values. The
fillnull directive applies to the
axes, not to the number of lines in the chart. Your 'by' field is
resTimeInMS so the lines plotted will be only those for which this field has values. Think about it: if you were plotting
by host how would you expect
timechart to "fill in gaps" in
host values? The only way to solve this is to use
append to force each range value to have an entry by appending exactly 1 event in each 15-minute span and then subtracting one from each before you plot it. I will have the implementation of this solution as an exercise for the OP.